Add INI setting session.hash_bits_per_character which enables developers
to choose how session ids are represented, regardless of the hash algorithm.

add INI setting session.hash_function
add support for creating session ids using SHA-1
source more entropy for session ids

Fix UMR

Modified for NetWare.

Bump year.

Fixed bug #21268 (session_decode() returned FALSE on success).

correct code that is guarded by "#if 0"

php_error -> php_error_docref

Add an error message to the ini handlers

add protective checks to ini updates

Noticed by: Derick Rethans <d.rethans@jdimedia.nl>
PR: #20284

improved warning message

# this should really link to an external page which explains the issue deeply

Print out warning only, if a variable was actually migrated

Silence warning.

Code cleanup. Thanks Andi.

session_decode should not segfault

Don't emit warning, if there is nothing to send

- Fix ZTS build

Make the interpretation of gc_probability configurable by adding
session.gc_dividend. The probability of running gc on each request is then
gc_probability/gc_dividend.

Use ZEND_SET_SYMBOL_WITH_LENGTH correctly (hopefully)

It strikes me as awkward that a Zend API user needs to take care of
doing the engine's reference counting.

This fixes a mem

Use ZEND_SET_SYMBOL_WITH_LENGTH correctly (hopefully)

It strikes me as awkward that a Zend API user needs to take care of
doing the engine's reference counting.

This fixes a memory overrun in a testcase. All ZEND_SET_* calls
should be correct now.

show more ...

(track_init) Use is_ref/refcount parameters of SET_SYMBOL macros

(save_current_state) Prevent a possible deadlock which occurs when
the track vars are inaccessible

Align behaviour with 4.2 with regard to register_globals=1

session_register("c");
unset($c);
$c = time();

If a user unsets a global session variable, it is not a reference

Align behaviour with 4.2 with regard to register_globals=1

session_register("c");
unset($c);
$c = time();

If a user unsets a global session variable, it is not a reference
to a $_SESSION slot anymore.

During serialization, PHP 4.2 will not find the respective entry in
$_SESSION and fall back to the global sym table.

show more ...

Nuke PS(vars), we keep the state of registered session variables now
completely in PS(http_session_vars). This avoids bugs which are caused
by a lack of synchronization between the two hashes

Nuke PS(vars), we keep the state of registered session variables now
completely in PS(http_session_vars). This avoids bugs which are caused
by a lack of synchronization between the two hashes. We also don't need
to worry about prioritizing one of them.

Add session.bug_compat_42 and session.bug_compat_warn which are enabled
by default. The logic behind bug_compat_42:

IF bug_compat_42 is on, and
IF register_globals is off, and
IF any value of $_SESSION["key"] is NULL, and
IF there is a global variable $key, then
$_SESSION["key"] is set to $key.

The extension emits this warning once per script, unless told otherwise.

"Your script possibly relies on a session side-effect which existed until
PHP 4.2.3. Please be advised that the session extension does not consider
global variables as a source of data, unless register_globals is enabled.
You can disable this functionality and this warning by setting
session.bug_compat_42 or session.bug_compat_warn.

show more ...

Fix harmless memory leaks and simplify track_vars_init.

The session extension ensures now that get_session_var can rely
on the state of $_SESSION/$HTTP_SESSION_VARS. It does not look up
symbols in the global symbol table anymore.

This was

The session extension ensures now that get_session_var can rely
on the state of $_SESSION/$HTTP_SESSION_VARS. It does not look up
symbols in the global symbol table anymore.

This was achieved by actually planting references between every
$_SESSION["x"] and $x, not only when restoring a session, but also
when registering a session variable (in a register_globals=1 context).

Upon registering a new variable, this memory leak continues to show
up, regardless of register_globals.

ext/session/session.c(272) : Freeing 0x0818F01C (12 bytes), script=test

Obviously, the newly allocated empty zval is not properly freed. If anyone
has any idea on how to fix that, please step forward.

show more ...

ws fix